HIPAA. We are all sick of the acronym by now, and the April 20 compliance deadline for the Health Insurance Portability and Accountability Act is looming.
At the state agency where I work, the information security officer (ISO), who is responsible for HIPAA security rule compliance, has spent the past seven months or so writing policies and procedures. He divided them into two groups: "required" (stuff we have to do) and "addressable" (stuff we'd better be thinking about doing).

When I came aboard, only one of the policies had been approved by the agency chiefs. Everything is done by consensus here -- if one chief doesn't like a single sentence, the policy is rejected, edited and then resubmitted. I was starting to panic about the approaching deadline. If we can't get the policies approved, we certainly can't implement them.